Now that “data” has become a normal, almost invisible, part of the lives of just about everybody in the industrialized world, focus has for many entities shifted to questions of security and integrity of the data. Central to many known solutions to issues such as security and integrity are digital signatures, that is, digital information that is associated with, and often at least partially derived from, the contents of the data set (such as a document) to be signed, and often an indication of the identity of the user/owner.
Different methods may be used to create digital signatures and verify documents. One common signature scheme uses keys that are issued by some certificate authority. The well-known Public Key Infrastructure (PKI) is an example of such a system. One problem with PKI-based signature schemes is not only the need to store and maintain the key sets, but also that PKI keys may expire, along with their underlying digital certificates. This problem is multiplied in environments in which there might be an enormous number of “perishable” key pairs associated with the many documents in circulation. Another disadvantage of PKI-based signature schemes is that they require trust of the issuing authority. Moreover, recent research indicates that some common keys may have “back doors” embedded in them, or may be generated using comprised pseudo-random number seeding routines.
Another increasing data security challenge is the ubiquity of “smart” devices such as mobile phones or items provided with “smart cards” and the desire to be able to secure and/or verify data sets that they generate or receive as well. Many known security solutions generally impose too great a computational and/or storage load on the devices, which usually have fewer and less powerful resources than, for example, a server or even laptop computer.